One surprise is it's also a debut feature, by Australian director Anthony Maras. You'd never know. Maras hardly puts a foot wrong – starting with the decision to work with John Collee (co-writer of Master and Commander and Happy Feet), one of the best screenwriters this country has produced – even if he was born in Scotland.

This script is water-tight. It starts with the particular – the terrorists landing in rubber boats in a Mumbai slum, unnoticed – and builds organically, with a sense of natural flow, rather than imposition.

Disaster movies can sometimes seem like the mechanical assemblage of unrelated parts, a series of random moments, lined up with hindsight. Hotel Mumbai avoids that by going straight into the attack, soon after the Pakistani gunmen arrive on the streets.

The film-makers don't worry about building characters at this stage: they take care of that later, if the person lives long enough. It's brutal and yes, random in that sense, just like the attacks.

Who are these young men, who arrive so ready to kill? The script does not try to explain or excuse, it just shows us they are committed and cool-headed. Someone has trained them well.

They speak to their controller, somewhere in Pakistan, as they kill. This man's words are chilling and largely verbatim – they are based on phone recordings made at the time by Indian intelligence.

The attackers split up. Two men attack a cafe, where several Australian backpackers manage to flee. They run terrified in a pack towards the Taj Palace Hotel for safety.

The doorman panics, tries to block them, until a senior staffer tells him to open the doors: we must help them. Two attackers mingle at the back of the group, gaining easy entry. No good deed goes unpunished, like the saying goes.

Inside the hotel, the film gives us some key characters to root for, most of them composites. Dev Patel is Arjun, a poor waiter who kisses his wife and child goodbye, but loses a shoe on the way to work. (This kiss bothered me: in a dozen trips to India I have never seen a couple kiss in public).

Arjun is a composite, but every movie needs some star power.

Anupam Kher, as Hemant Oberoi, the head chef at the Taj, is not. Oberoi's story, as he takes charge of protecting both staff and guests, is one of the film's best assets – the man defined grace under pressure.

Armie Hammer and Nazanin Boniadi portray an affluent couple, travelling with baby and nanny (Tilda Cobham-Hervey). Jason Isaacs is a crude Russian who has two hookers waiting for him upstairs, when the guns start blazing. These are all composites, except the chef.

Collee and Maras are careful to balance the colours here: it's not a film about what happened to the white folks. And they are careful to show the attackers were also human, as hard as that is for most of us to grant. A few have their moments of crisis; one calls his family, who do not know where he is, to find out if they have been paid the money they were promised.

It's not an easy movie to watch, even harder to resist. If we are to submit to a depiction of these terrible events, there has to be a point – and not an easy one. These things happened; you don't want to come out of the movie scratching your head and thinking, I still have no idea why this took place.

The film passes that test, as it strikes fear in your heart. This is the world we live in. This is what some people went through. This is what some people did.